CVE-2025-12901: Asgaros Forum Plugin CSRF Vulnerability

CVE-2025-12901 Overview

CVE-2025-12901 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Asgaros Forum plugin for WordPress in all versions up to and including 3.2.1. The flaw stems from missing nonce validation on the set_subscription_level() function inside includes/forum-notifications.php. Unauthenticated attackers can modify the subscription settings of authenticated forum users by tricking a logged-in victim into clicking a crafted link or visiting an attacker-controlled page. The issue is tracked under [CWE-352] and carries a CVSS 3.1 base score of 4.3.

Critical Impact
Attackers can silently change a victim's forum subscription preferences whenever a logged-in user is lured into loading a malicious request, impacting notification integrity for community sites.

Affected Products

Asgaros Forum plugin for WordPress, versions up to and including 3.2.1
WordPress sites running the vulnerable plugin with authenticated forum users
Any site relying on set_subscription_level() from includes/forum-notifications.php

Discovery Timeline

2025-11-12 - CVE-2025-12901 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12901

Vulnerability Analysis

The Asgaros Forum plugin exposes a subscription preferences form that posts to the subscriptions endpoint. The handler invokes set_subscription_level() to persist the user's chosen subscription mode. In versions up to 3.2.1, this handler does not verify a WordPress nonce before writing the new value. Because WordPress relies on nonces to bind a state-changing request to a specific user session, the absence of wp_verify_nonce() (or equivalent) allows any cross-origin form submission to succeed against an authenticated user's session cookies.

The request requires user interaction, such as clicking a link or loading an attacker-controlled page that auto-submits a form. However, no privileges are required on the attacker side, and the request travels over the network. The impact is limited to integrity of the victim's subscription configuration — no confidentiality or availability loss is expected.

Root Cause

The root cause is missing anti-CSRF token generation and validation in the subscription settings form. The vulnerable code in includes/forum-notifications.php renders the <form> without a wp_nonce_field() call, and the corresponding POST handler never checks a nonce. This violates WordPress's standard state-change protection pattern and maps to [CWE-352]: Cross-Site Request Forgery.

Attack Vector

An attacker hosts a page containing an auto-submitting HTML form targeting the victim site's subscription endpoint. When a logged-in forum user visits the page, their browser sends the request with valid authentication cookies, and the plugin applies the attacker-chosen subscription_level to the victim's profile.

php

// Security patch (Source: https://github.com/Asgaros/asgaros-forum/commit/92305fb8ba4ec0a6c65256915d0a32e5553b74f3)
echo '<div id="subscriptions-panel" class="content-container">';
    echo '<form method="post" action="'.esc_url($this->asgarosforum->get_link('subscriptions')).'">';
+       wp_nonce_field('asgaros_forum_change_subscription_level');
        echo '<div class="action-panel">';
            echo '<label class="action-panel-option">';
                echo '<input type="radio" name="subscription_level" value="1" '.checked($subscription_level, 1, false).'>'.esc_html__('Individual Subscriptions', 'asgaros-forum');

The patch adds wp_nonce_field('asgaros_forum_change_subscription_level') to the form, enabling server-side nonce validation on submission.

Detection Methods for CVE-2025-12901

Indicators of Compromise

POST requests to the Asgaros Forum subscriptions endpoint whose Referer or Origin headers point to third-party domains.
Unexpected changes to the subscription_level value in the plugin's user metadata table without a preceding legitimate settings page load.
Bursts of subscription setting updates from multiple authenticated users within a short window, suggesting a mass phishing lure.

Detection Strategies

Enable web server or WAF logging for POST requests to /?view=subscriptions and correlate Referer values against the site's own domain.
Audit WordPress database changes on the Asgaros Forum user meta rows tied to subscription levels for entries lacking a corresponding admin-ajax or forum-page GET request from the same user.
Deploy a WAF rule to flag state-changing POSTs to the plugin endpoint that arrive without a valid _wpnonce parameter.

Monitoring Recommendations

Monitor WordPress plugin version inventory to identify sites still running Asgaros Forum 3.2.1 or earlier.
Track outbound clicks from forum email notifications and community channels for links that resolve to the subscription endpoint with pre-filled parameters.
Alert on user reports of unexpected subscription changes, which are the most reliable end-user signal of CSRF abuse.

How to Mitigate CVE-2025-12901

Immediate Actions Required

Update the Asgaros Forum plugin to the version released after 3.2.1 that includes commit 92305fb8ba4ec0a6c65256915d0a32e5553b74f3.
Review recent subscription setting changes and notify affected users to re-verify their preferences.
Enforce SameSite=Lax or SameSite=Strict on the WordPress authentication cookies where compatible with site functionality.

Patch Information

The vendor fixed the issue by adding wp_nonce_field('asgaros_forum_change_subscription_level') to the subscription form and validating the nonce on submit. See the GitHub commit, the WordPress plugin changeset, and the Wordfence advisory for details.

Workarounds

Temporarily disable the Asgaros Forum plugin on sites that cannot immediately update.
Deploy a WAF rule that blocks POSTs to the subscriptions endpoint lacking a valid _wpnonce field and a same-origin Referer.
Educate forum users about the risk of clicking untrusted links while authenticated to the community site.

bash

# Example WAF rule (ModSecurity) to block CSRF attempts against the subscription endpoint
SecRule REQUEST_METHOD "@streq POST" \
    "chain,phase:2,deny,status:403,id:1029012901,msg:'Asgaros Forum CSRF attempt (CVE-2025-12901)'"
  SecRule REQUEST_URI "@contains view=subscriptions" \
    "chain"
    SecRule &ARGS:_wpnonce "@eq 0"